Oxelone Docs

Search docs and API

Find a guide, a section of one, or an API operation by its name.

Open console (opens in a new tab)

Detections Triage an issue

Triage an issue

An issue is something that stays true until it is dealt with. Triage is how you record that. You can set its state, mute the condition so it is not raised again, label it with tags and talk about it in its discussion. Alerts have no triage; see Alerts and issues.

Who can do it

You want toPermissionRoles that hold it
Read issues, mutes, tags and the discussionalerts:read (View alerts)Every role
Change an issue's state, create or lift a mutealerts:triage (Triage alerts)Owner, Admin, Analyst
Add or remove tagsalerts:read (View alerts)Every role

Tags use the same permission that reads the issue, so anyone who can see an issue can tag it.

The four states

StateMeans
OpenNew, or found again.
AcknowledgedSomeone has seen it.
ResolvedFixed. It reopens if a later scan finds the same thing.
SuppressedSet aside. It does not reopen.

The inspector reminds you of the difference: "A resolved issue reopens if a later scan finds the same thing. A suppressed one does not."

When Oxelone closes an issue itself, for example because its machine was removed, the inspector shows Resolved by and a note. Your own change of state clears that.

Change a state

  1. Open Detections › Issues and select a row.
  2. Under Triage, choose Open, Acknowledged, Resolved or Suppressed.

Each press is saved at once and recorded in the audit log as issue.triaged. If it is refused, the old state stays selected and the reason shows beside the control.

Mutes

A mute silences a condition, not one row. While it holds, matching issues are not raised and the ones on file stop being refreshed. Alerts are still written. A mute governs the issues list and never the evidence.

Mute a condition

  1. Open an issue. Under Silence, choose Silence this condition.
  2. In Reason, say why. Whoever reviews the mute later reads exactly this sentence.
  3. Under Lifts, choose 1 day, 1 week, 30 days or Until I lift it, or pick a date with Lifts on a date.
  4. Choose the button, which reads Silence for 1 day, Silence until date, or Silence until lifted.

A date can be at most 90 days away. Renewing is a new mute with a new reason, which is the review.

Review and lift mutes

Mutes on the Issues page opens Muted conditions, with a count when any are live. Each row shows the reason, who set it and when it lifts. An issue that is muted shows the same facts under Silence, with a Lift button. Lifting needs alerts:triage; reading the list needs only alerts:read.

Tags

Tags are free text, shared across the workspace. In the inspector, open Tags and type in the box marked Add a tag. Words the workspace already uses appear under Already in use as you type.

RuleValue
Tags per issue32
Length of one tag64 characters
CaseStored in lower case; Needs Review and needs review are one tag
Not allowed;, ~ and , — use a hyphen

You can filter the list by tag.

Discussion

Each issue has a discussion in its inspector. A thread is one level deep: reply to the comment a reply belongs to, not to the reply.

When it goes wrong

You seeWhy
Could not change this issue's status.The change was not saved. The reason follows when the server gave one.
Say why this is being silenced.Reason is empty.
A mute may hold for at most 90 days. Renewing is a new mute with a new reason, which is the review.The date you chose is too far away.
Could not silence this conditionThe mute was not saved.
Could not lift this muteThe mute was not lifted.
Could not save these tags.The tags were not saved.
a comment needs something in it. To take one back, withdraw itThe comment is empty.
that comment is already a reply, and a thread here is one level deep. Reply to the comment it replies to insteadYou replied to a reply.

With the API

Issues, triage, mutes and an issue's tags are in the Detections reference. Comments are in Activity.